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V. SUMMARY OF THE CLAIMED SUBJECT MATTER 

The following is a description of the claimed subject matter with reference to each of 
independent claims 1, 12, 21, 35, 49-51, 55, 64, and 73-76. 

The context of the invention is implementation of an encryption process which involves 
the use of lookup tables. Fig. 1 shows a block cipher operation wherein input data 140 is 
subjected to an Exclusive-OR operation at 150 to obtain ciphered data. The ciphering input to 
150 comes from a block cipher 10 and is a function of a key 120 and an input 1 10. The present 
invention takes place within the cipher block 1 00. and is a more efficient method and apparatus 
for generating the output 130. In the example given in the specification, the ciphering algorithm 
to be implemented is a Kasumi algorithm. One of the parts of the Kasumi algorithm is an S7 
function explained by the formulas of Fig. 3, where it can be seen that for each 7-bit input X = 
X6X5X4X3X2X1X0 there is a 7-bit output Y = y6ysy4y3y2yiyo in which each bit of Y is a different 
logical function of the bits of X. 

There are 27 = 128 possible different permutations for a 7-bit X value, and therefore 27 = 
128 possible different values of Y. These are designated generally at 520 in Fig. 6. The 128 
different values of Y are stored in a look-up table structure , but the look-up table is divided into 
four different tables 540, each containing 32 entries. While the look-up tables store Y values, it 
should be kept in mind that the labeling in Fig. 6 is not the Y values. Each different Y value will 
correspond to a different one of 128 possible permutations of bit values for X. Thus, in the 
notation of Fig. 6, "S7(0000001)" represents the S7 function of an X value of 0000001, it 
designates the 7-bit Y value that results from an X value of 0000001 according to the S7 function 
shown formulaically in Fig. 3. 

Note that the entries in the top look-up table 540 all begin with the same x-value 00, the 
next table 540 contains entries all beginning with the most significant bits 01, the third table 10 
and the fourth table 1 1 . Within each table, there are 32 different values corresponding to 32 
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different permutations of the least significant five bits in combination with the particular pair of 
most significant bits. 

The selection process is that, for each look-up table 540, the five least significant bits of 
the X input are used to select one of the 32 possible Y-values at step 581 in Fig. 6, thereby 
resulting in four different Y-value outputs 506. In the next two selection steps 582 and 583 in 
Fig. 6, the value of the two most significant bits of the current X value is then used to select one 
of the four Y-value outputs. 

Finally, while Fig. 6 illustrates the process for a given value of X, it is noted that this 
process takes place in parallel for plural Xi inputs, as noted in the last three lines of 0057. 

While the flow of the process is shown in Figs. 5 and 6 to implement the formulas in Fig. 
3, the apparatus for doing so is illustrated in Fig. 19 A. The look-up tables 540 in Fig. 6 are 
represented by memory 1810 in Fig. 19 A, responding to a plurality of X inputs 1840 to produce 
a plurality of outputs, and the processor 1820 then uses the most significant bits to select one of 
the outputs for each X input, to produce outputs 1830. 

Thus, in the language of claim 1, for plural inputs Xi, each input defined by a first set of 
bits (the five least significant bits) and a second set of bits (the two most significant bits), looking 
up one element from each look-up table 540 (Fig. 6) using the first set of bits to obtain a set of 
corresponding outputs 591-594, and then selecting a corresponding output from that set using the 
second set of bits. This is described in the specification at paragraph [0057]. 

In claim 12, and with reference to Fig. 19A, the memory is shown at 1810, processor at 
1820, and the functions performed by the processor 1820 being as described above for claim 1 
and as described at paragraphs 0137 and 0138. 

Claim 21 is directed to an alternative implementation shown in Figs. 1 1 and 20 and 
described beginning in paragraph 0142, where the plurality of bits making up each of N inputs 
are separated into subsets, Fig. 20 showing two subsets 2004 and 2006 for each of the N inputs. 
Each subset of input bits is used to access a look-up table, so that the N subsets 204 yield N 
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Group 1 outputs 2012 and the N subsets 2006 yield N Group M outputs 2014. respective ones of 
the Group 1 and Group 2 outputs are then combined at 2016to obtain N outputs 2018. 

Claim 35 is directed to an apparatus for performing the method of claim 21, and this is 
the same apparatus as in Fig. 19 A, with the memory 1810 storing the look-up table elements and 
the processor 1820 performing the method described at paragraph 0139, where a subset of bits is 
used to select an element from each look-up table and then the outputs of the look-up tables are 
combined. 

Claim 49 is directed to a computer readable medium carrying code for implementing the 
method of claim 1. The support in the specification for the method steps is as discussed above in 
the context of claim 1, and the storage of code for these functions on a computer readable 
medium is inherent in the process being implemented by a processor as described, e.g., at 
paragraph 0062. 

Claim 50 is directed to a computer readable medium carrying code for implementing the 
method of claim 21. The support in the specification for the method steps is as discussed above 
in the context of claim 21, and the storage of code for these functions on a computer readable 
medium is inherent in the process being implemented by a processor as described, e.g., at 
paragraph 0062. 

Claim 51 is directed to the method shown in Fig. 20 and described beginning at 
paragraph 0142, with the bit reordering on the inputs being performed to produce M parallel sets 
of outputs, then for each parallel set of outputs, performing a parallel lookup table operation to 
generate a corresponding parallel set of outputs containing N outputs, and finally, for each of the 
inputs, generating a respective output by performing a bit combining operation on the outputs 
from the parallel look-up table operations associated with the input. 

Claim 55 is directed to a ciphering method described in the specification at paragraph[hs 
0057 and 0140, and illustrated in Figs. 4 and 6, the invention being an improvement in a 
ciphering method illustrated in Fig. 1. 
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Claim 64 is directed to the apparatus performing the method of claim 55, the apparatus 
shown in Fig. 19A, with the memory at 1810 and the processor at 1820. The functions 
performed by the processor and recited in claim 64 are discussed at paragraphs 0057 and 0140 
and shown in Figs. 4 and 6. 

Claim 73 is directed to a computer readable medium carrying code for implementing the 
method of claim 55. Support for the method steps is as discussed above in te context of claim 
55, and support for the storage of code for these functions on a computer readable medium is 
inherent in the process being implemented by a processor as described, e.g., at paragraph 0062. 

Claim 74 is directed more broadly to a method as recited in claim 55, and support for the 
method steps in claim 74 is found in paragraphs 0057 and 0140 and in Figs. 4 and 6. 

Claim 75 is directed to an apparatus (Fig. 19 A) for performing a method similar to claim 
55. Support for the method steps is as discussed above in the context of claim 1, with the 
memory and processor as shown in Fig. 19A. 

Claim 76 is directed to a computer readable medium carrying code for practicing the 
method of claim 75. Support for the storage of code for these functions on a computer readable 
medium is inherent in the process being implemented by a processor as described, e.g., at 
paragraph 0062. 
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